[SOLVED] Random BSOD - Windows 7 x64

[nachos]

I have been getting random BSODs during normal use,normally whenever I play a game or surf the web,and I can't figure out how to fix it.It started last month and I've been getting even more BSODs day after day.I ran a Blue Screen Viewer and I've been getting a lot of STOP errors.
System specs:
CPU: Intel(R) Core(TM)2 Duo CPU E4600 @ 2.40GHz
Motherboard: Hewlett-Packard 0B10H
BIOS: Phoenix - AwardBIOS v6.00PG
RAM: 4.00 GB
HDD: ST3160815AS ATA Device
Sound Card: Realtek High Definition Audio
Graphics card: NVIDIA GeForce 8500 GT
OS: Microsoft Windows 7 Ultimate 64-bit 7601 Multiprocessor Free Service Pack 1

Screenshot of BlueScreenViewer:

ZIP file from SysnativeBSODCollectionApp:View attachment 11185

 

[Patrick]

Sorry, I took a look at this yesterday but didn't get to reply til today.

So good news, this is probably a really bad developed driver causing these crashes.

1: kd> .bugcheck
Bugcheck code 00000050
Arguments fffffa7f`ffffffea 00000000`00000000 fffff800`038c806b 00000000`00000007

Address fffffa7f`ffffffea was written to by address fffff800`038c806b, where did we go wrong?

1: kd> r cr2
cr2=fffffa7fffffffea

1: kd> !pte 
                                           VA 0000000000000000
PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00000    PDE at FFFFF6FB40000000    PTE at FFFFF68000000000
Unable to get PPE FFFFF6FB7DA00000

1: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`061c66b8 fffff800`0390f53b : 00000000`00000050 fffffa7f`ffffffea 00000000`00000000 fffff880`061c6820 : nt!KeBugCheckEx
fffff880`061c66c0 fffff800`03890cee : 00000000`00000000 fffffa7f`ffffffea fffff8a0`0e690d00 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x43781
fffff880`061c6820 fffff800`038c806b : fffff800`0385aed7 ffffffff`ffffffff 00000000`000815e9 fffffa80`058c1730 : nt!KiPageFault+0x16e (TrapFrame @ fffff880`061c6820)
fffff880`061c69b8 fffff800`0385aed7 : ffffffff`ffffffff 00000000`000815e9 fffffa80`058c1730 00000000`00000000 : nt!MiMapPageInHyperSpaceWorker+0x1b
fffff880`061c69c0 fffff800`03b4b4df : 00000000`00000000 00000000`00000000 00000000`00000001 fffffa80`0396df30 : nt! ?? ::FNODOBFM::`string'+0x16a66
fffff880`061c6a40 fffff800`03b4a437 : fffffa80`058c1730 fffffa80`0396df30 fffffa80`00000000 fffffa80`00000001 : nt!MmDeleteProcessAddressSpace+0x47
fffff880`061c6a80 fffff800`0389be54 : 00000000`00000000 fffffa80`0608eb30 fffffa80`058c1700 fffff8a0`16a70030 : nt!PspProcessDelete+0x177
fffff880`061c6ae0 fffff800`03b8a1f4 : fffffa80`0608eb30 00000000`00000000 fffffa80`051466a0 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`061c6b40 fffff800`03b8a7a4 : 00000000`000008cc fffffa80`0608eb30 fffff8a0`04225f90 00000000`000008cc : nt!ObpCloseHandleTableEntry+0xc4
fffff880`061c6bd0 fffff800`03891e53 : fffffa80`051466a0 fffff880`061c6ca0 00000000`00000000 00000000`00000000 : nt!ObpCloseHandle+0x94
fffff880`061c6c20 00000000`776d13aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`061c6c20)
00000000`05f4efd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776d13aa

1: kd> .trap fffff880`061c6820
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000058000000000 rbx=0000000000000000 rcx=ffffffffffffffff
rdx=fffff880061c6a40 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800038c806b rsp=fffff880061c69b8 rbp=0000058000000000
 r8=fffffa7fffffffd0  r9=0000000000000001 r10=0000000000000002
r11=fffff880061c6990 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!MiMapPageInHyperSpaceWorker+0x1b:
fffff800`038c806b 458a481a        mov     r9b,byte ptr [r8+1Ah] ds:fffffa7f`ffffffea=??

Setting the lower 8 bits of r9 to the value stored at address r8+1A.

1: kd> !pte fffffa7fffffffd0
                                           VA fffffa7fffffffd0
PXE at FFFFF6FB7DBEDFA0    PPE at FFFFF6FB7DBF4FF8    PDE at FFFFF6FB7E9FFFF8    PTE at FFFFF6FD3FFFFFF8
contains 0000000000000000
not valid

r8's not valid.

Since we have nothing like code wanting to write to a valid address, but instead the first parameter/cr2 state another address, this as I said above is probably a driver causing this. Right away I see the usual suspects:

1. Get rid of avast! with MSE. Not another 3rd party for now, MSE.

avast! removal - http://www.avast.com/uninstall-utility

MSE - Microsoft Security Essentials - Microsoft Windows

2. In your loaded drivers list, dtsoftbus01.sys is listed which is the Daemon Tools driver. Daemon Tools is a very popular cause of BSOD's in 7/8 based systems. Please uninstall Daemon Tools. Alternative imaging programs are: MagicISO, Power ISO, etc.

 

[nachos]

Thank you for your time,I will uninstall avast using the removal tool.Although I have already uninstalled DAEMON tools and run SPTD installer before,it shows that I have nothing else to uninstall.Any idea how to remove it?

 

[Patrick]

Hm, it may have been because I was looking at a dump before you removed it.

If you check C:\Windows\System32\Drivers, is dtsoftbus01.sys there?

 

[nachos]

It's not there,as you said you probably looked at an old dump file.I'll let you know if I get any more BSODs.It mostly occurs when I play Dota,so I'll play that for some time and see if a BSOD occurs or not.

 

[Patrick]

Let me know how it goes.

 

[nachos]

Everything is working flawlessly,so far no BSODs.Thanks for the help.

 

[Patrick]

Good to hear, thanks for the update.